Full-Processor Timing Channel Protection with Applications to Secure Hardware Compartments

This paper presents timing compartments, an architecture abstraction that explicitly removes microarchitecture-level timing channels between groups of software running concurrently on a shared multi-core processor. The capability to eliminate timing channels coupled with conventional software isolation enables strong isolation comparable to running software on separate physical machines. This paper shows that such a strong timing isolation can be achieved by systematically removing timing interference in shared resources in a multi-core, and formally checked using information flow analysis on an RTL implementation. Through this systematic process, we identify and remove new sources of timing channels, including cache coherence mechanisms and module interfaces, and introduce new performance optimizations. We also demonstrate how timing compartments may be extended to support a hardwareonly TCB which ensures security even when the system is managed by an untrusted OS or hypervisor. Experimental studies show that the performance overheads of strict timing isolation can be surprisingly low for a small number of timing compartments; executing two timing compartments reduces system throughput by less than 7% on average and by less than 2% for compute-bound workloads.